Purpose

What KYC and customer due diligence actually test

The provider must understand the customer, ownership and expected use of the service well enough to assess financial-crime risk.

Original analysis by Matt Di Vincere

Matt's original guide explained why onboarding checks differ between customers and countries. This version adds the FCA's 2026 CDD findings and clearer source-of-funds workflows.

The KYC question setA transfer provider can revisit these questions after onboarding.
QuestionWhat the provider may collectWhy it matters
Who is the customer?Legal name, birth date, address, nationality and identity evidenceIdentify and verify the person or entity
Who owns or controls it?Directors, authorised signers and ultimate beneficial ownersUnderstand company or trust control
Why is the account needed?Expected currencies, countries, amounts, frequency and payment purposesBuild a risk profile for monitoring
Where did this money come from?Bank statements and transaction-specific evidenceTest the lawful source of funds
How was wider wealth built?Career, business sale, inheritance, investments or other historyAssess source of wealth when risk warrants it

UK Regulation 28 requires identification, verification and an assessment of the purpose and intended nature of the relationship or transaction. The FCA says firms must form a complete enough picture to support ongoing monitoring. If a firm cannot complete the required due diligence, it may be unable to open or continue the relationship.

Individuals

KYC documents for a personal transfer account

Digital verification can complete much of the process, but a manual document request remains normal.

Use colour scans or photographs with all edges visible. The document must be current, readable and unaltered. The spelling and order of names can differ across passports and bank accounts, so explain a genuine difference rather than editing the file.

An address database check can replace paper evidence for some customers. International clients, recent movers and people with thin credit files are more likely to receive a manual request.

Businesses

Business KYC and beneficial ownership

The provider must verify that the entity exists, understand who controls it and confirm who may act for it.

Common business onboarding packExact requirements change by legal form and country.
Document or recordWhat it supportsCommon issue
Certificate of incorporation and registry extractLegal existence and registration numberOld company name or stale registry data
Articles, constitution or partnership agreementGovernance and authoritySignatory not authorised by the documents
Registered and trading address evidenceLocation of the legal and operating businessVirtual office not explained
Director and UBO identity documentsNatural persons who manage or ultimately own the businessOwnership chart stops at another company
Board resolution or authority letterPermission for users to open and operate the accountNo clear maker or approver authority
Invoices, contracts and statementsExpected business activity and source of paymentsTransaction does not match stated business model

UK guidance requires firms to understand ownership and control until they reach the natural people who ultimately own or control the entity. A group chart should show percentages and jurisdictions at every layer. Listed companies and regulated entities can have different evidence routes, but the transfer provider decides what it needs for its risk assessment.

Use a business account to fund a business transfer. A payment from a director's personal card or unrelated company can look like third-party funding and trigger questions even when the commercial transaction is legitimate.

Large transfers

Source of funds and source of wealth

The two terms answer different questions and often need different evidence.

Source of funds

Where the money for this transaction came from, such as a named bank account, property sale or inheritance.

Source of wealth

How the customer built their overall wealth over time, such as employment, business ownership or investments.

Payment purpose

Why the money is moving now, such as completion, supplier invoice or family support.

Ownership chain

Why the sender, account holder, contractual party and recipient are connected.

Evidence by transaction typeProvide the contract and the matching bank trail.
TransactionCore evidenceSupporting trail
Property saleSigned sale or completion statementStatement showing receipt of proceeds
InheritanceWill, probate or estate distribution statementExecutor or estate payment trail
Business dividend or saleAccounts, resolution, sale agreement or completion statementCompany and personal bank trail
Salary or savingsPayslips, employment record or tax returnStatements showing accumulation
GiftSigned gift letter and relationshipDonor's source-of-funds evidence and payment statement

A single screenshot of a balance usually proves only that money is in an account. It may not prove how the money arrived there. Build the chain from the underlying event through the bank statement to the transfer provider.

Enhanced checks

When enhanced due diligence appears

The amount alone does not decide the level of review. The provider looks at the whole risk pattern.

Enhanced due diligence can apply to politically exposed persons, higher-risk jurisdictions, unusual ownership, sanctions exposure, unusually large or complex transactions and activity without a clear economic purpose. A routine £500,000 house sale with a clean completion trail can be easier to explain than a smaller payment passing through several unrelated accounts.

HMRC guidance says unusually large or complex activity must be understood relative to what is normal for that customer and business. AUSTRAC similarly distinguishes transaction-specific source of funds from broader source of wealth and expects stronger checks where risk is higher.

FCA 2026 findings

The FCA's April 2026 multi-firm review found good and poor practice in CDD, EDD and ongoing monitoring. Its message is not that every customer should face the same checklist. Firms need policies and evidence that match risk.

If a provider asks a question you cannot answer immediately, respond with a short chronology and label each attachment. Sending ten unexplained files slows review. Do not conceal a third-party account or ownership layer. The mismatch is likely to surface later.

Troubleshooting

Why verification fails and how to respond

Most onboarding problems are document, identity or story mismatches rather than a single missing form.

  • The photograph is blurred, cropped, expired or shows glare.
  • The address document is outside the provider's accepted date window.
  • The bank account or card name does not match the transfer customer.
  • A business ownership chart stops before identifying natural-person owners.
  • The payment size or country does not match the expected activity declared at onboarding.
  • The source-of-funds document proves a balance but not the event that created it.

Ask which exact fact remains unverified. Replace the weak document rather than uploading more of the same. If a provider declines the account, it may be unable to explain every internal risk signal or suspicious-activity concern. Do not submit altered documents or invent a payment purpose.

Upload through the provider's authenticated portal. Verify the domain before using an email link. Read the FCA regulation guide to check the legal entity handling the payment and the transfer safety guide for phishing checks.